CVE-2026-100230

Deferred Deferred - Pending Action

Path Traversal in Input Leap via DDRG Message

Publication date: 2026-09-25

Last updated on: 2026-09-30

Assigner: MITRE

Description

Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-30

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-100230

EUVD

EUVD-2026-87130

Affected Vendors & Products

Vendor	Product	Version / Range
input_leap	input_leap	From 1.0.0 (inc) to 3.0.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-180	The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.

Attack-Flow Graph

Executive Summary

Input Leap through version 3.0.3 has a directory traversal vulnerability when the non-default --enable-drag-drop option is used on Windows or macOS. This flaw allows attackers to exploit the / versus \ distinction to write files to arbitrary directories, including startup directories, which could lead to code execution.

Detection Guidance

This vulnerability is specific to Input Leap versions through 3.0.3 when the --enable-drag-drop option is enabled on Windows or macOS. Detection involves checking the installed version of Input Leap and verifying if the vulnerable option is active. No direct commands are provided in the context to detect this issue.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code on your system by writing a malicious file to a startup directory. This could lead to unauthorized access, data theft, or further compromise of your system.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations could face legal penalties, reputational damage, and loss of trust if such an exploit occurs.

Mitigation Strategies

Disable the --enable-drag-drop option if it is enabled. Update Input Leap to a version that fixes this issue, specifically version 3.0.3 or later. Monitor startup directories for unauthorized files.

Hi! I’m here to help you understand CVE-2026-100230. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70